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ABSTRACT 

The  Threat  Oriented  Survivability  Optimization  Model  (TOSOM),  [1],  is  a  simple,  first- 
order  model  used  to  evaluate  the  worth  of  suites  of  countermeasures  in  protecting  a 
combat  platform. 

In  a  typical  TOSOM  study,  one  of  the  first  steps  is  to  develop  the  threats  that  the  platform 
in  question  will  encounter.  These  threats  are  arranged  in  threat  tree  form;  that  is,  the 
threats  are  broken  into  classes  of  threats  (for  example,  Direct  Fire,  Indirect  Fire,  Air),  and 
then  each  class  is  divided  into  a  subclass;  this  process  continues  until  the  actual  threats 
encountered  by  the  platform  in  question  are  enumerated.  Each  branch  of  the  tree  is  also 
given  a  relative  probability  of  occurrence  (that  is,  the  sum  of  the  probabilities  of  all 
branches  emanating  from  each  node  of  the  tree  must  be  equal  to  1 ).  Thus,  ignoring  the 
special  tree  structure  arrangement  of  the  threats,  a  threat  tree  is  in  essence  the  distribution 
of  threats  attacking  a  single  platform. 

In  a  system-of-systems  environment  each  platform  will  possess  its  own  threat  tree.  Also 
of  interest  in  such  an  environment  is  what  will  be  called  a  platform  tree;  that  is,  the 
distribution  of  platforms  that  are  attacked  by  a  single  type  of  threat. 

In  this  paper  we  wish  to  examine  threat  trees,  platform  trees,  their  connection,  and  how 
they  might  be  combined  in  order  to  provide  a  comprehensive  view  of  the  battlefield  threat 
situation  encountered  by  a  system-of-systems. 

INTRODUCTION 

The  purpose  of  the  model  TOSOM  is  to  select  a  suite  of  countermeasures,  constrained  by 
cost,  weight,  and  other  burdens,  that  will  maximize  the  survivability  of  a  particular  type 
of  platform,  subject  to  the  given  constraints.  Historically,  it  was  accepted  that  to 
maximize  the  survivability  of  the  force,  it  was  sufficient  to  maximize  the  survivability  of 
each  type  of  combat  platform.  For  this  task  TOSOM  has  proven  its  worth.  However,  in  a 
system-of-systems  environment,  while  it  is  true  that  near  maximum  force  survivability 
can  be  obtained  by  maximizing  the  survivability  of  the  individual  platforms  comprising 
that  force,  it  also  may  be  the  case  that  this  level  of  survivability  can  be  achieved  in  a 
more  effective  fashion.  What  information  is  needed  to  investigate  this  possibility?  Is 
knowledge  of  each  platform’s  threat  tree  sufficient?  Thus,  the  question  that  motivates  this 
paper  is  one  first  asked  by  Frederick  Schwarz,  [2],  namely:  How  can  threat  trees  for 
various  platforms  be  combined  into  a  threat  tree  for  the  force?  The  rough  answer, 
developed  below,  is  that  they  can’t.  That  is,  though  threat  trees  for  the  individual 
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platforms  are  sufficient  to  maximize  each  platform’s  survivability,  they  are  collectively 
insufficient  to  describe  the  entire  battlefield  environment. 

If  threat  trees  can’t  be  combined  to  yield  the  force  structure  for  a  system-of-systems,  then 
could  platform  trees  be  so  combined?  Again,  the  rough  answer  is  that  they  cannot.  There 
are  other  questions  that  are  of  relevance  here.  For  example,  what  is  the  connection 
between  threat  trees  and  platform  trees?  Does  either  type  of  tree  determine  the  other? 

And  if  neither  threat  trees  not  platform  trees  provide  an  adequate  description  of  the 
system-of-systems’  threat  environment,  what  information  would  be  required  for  such  a 
description? 

DEFINITIONS  AND  EXAMPLES 

Ultimately,  a  threat  tree  is  a  list  of  threats  against  a  particular  platform  that  are  judged  to 
be  available  to  an  enemy  for  use  against  that  platform  and  associated  with  each  threat  in 
the  list  is  a  probability  of  encounter,  with  the  condition  that  the  sum  of  the  probabilities 
of  encounter  for  all  threats  on  the  list  be  equal  to  1 . 

In  Figure  1  an  example  of  a  very  simple  threat  tree  is  presented. 


Figure  1.  A  simple  threat  tree. 

A  non-graphical  representation  of  the  threat  tree  shown  in  Figure  1  is  given  by:  { 77,  .8; 
T2,  .2}. 

Figure  2  provides  an  example  of  a  more  realistic  and  typical  threat  tree. 
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Figure  2.  A  typical  threat  tree. 

A  non-graphical  representation  of  this  treat  tree  is  given  by:  {Threat  1,  .04;  ....},  where 
each  probability  of  encounter  is  calculated  by  multiply  down  the  braches  of  the  tree.  For 
example,  the  probability  of  encounter  for  Threat  1  is  calculated  as  follows:  a  x  b  x  c  x  d 
which  gives  .04. 

A  platform  tree  is  a  list  of  platforms  attackable  by  a  particular  threat  together  with  a 
probability  of  engagement  for  each  platform,  with  the  condition  that  the  sum  of  the 
probabilities  of  engagement  for  all  platforms  on  the  list  be  equal  to  1 . 

Figure  3  provides  an  example  of  a  simple  platform  tree.  When  viewing  the  platform  tree, 
recall  that  a  single  (type)  of  threat  is  understood. 


Figure  3.  A  simple  platform  tree. 

The  platform  tree  in  Figure  3  means  that  an  enemy  will  engage  F7-type  platforms  with 
70%  of  his  stock  of  the  given  threat,  and  will  engage  P2- type  platforms  with  the 
remaining  30%  of  the  postulated  threat. 

A  non-graphical  representation  of  the  platform  tree  given  in  Figure  3  is:  {PI,  .7;  P2,  .3}. 
A  more  typical  and  more  realistic  platform  tree  is  shown  in  Figure  4. 
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Figure  4.  A  typical  platform  tree. 

The  understood  threat  in  Figure  4  is  a  rocket  propelled  grenade  (RPG).  For  the  platform 
tree  illustrated  in  Figure  4  a  non-graphical  representation  is:  {Truck,  .720;  Tank,  .045; 
IFV,  .135;  Flelicopter,  TOO},  or,  more  descriptively  if  the  understood  threat  needs  explicit 
emphasis,  (RPG-  Truck,  .720;  Tank,  .045;  IFV,  .135;  Helicopter,  TOO},  where  the 
probabilities  of  engagement  are  obtained  by  multiplying  down  the  branches  of  the  tree. 

COMBINING  SCENARIOS 

Consider  the  situation  in  which  the  particular  platform  under  study  is  to  be  used  in  two 
different  scenarios,  for  example,  a  major  combat  operation  and  an  insurgency.  Suppose 
further  that  the  threat  trees  for  these  two  operations  are  as  given  in  Figure  5. 


Figure  5.  Threat  trees,  same  platform,  different  scenarios. 
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In  designing  a  countermeasure  suite  for  the  platform  under  consideration,  the  analyst  has 
at  least  two  choices.  First,  he  could  design  a  countermeasure  suite  for  each  scenario.  This 
approach  has  the  advantage  of  optimizing  the  survivability  of  the  platform  in  each 
scenario,  but  has  the  disadvantage  of  essentially  creating  two  platforms  with  the  attendant 
double  impact  upon  logistical  and  training  considerations. 

A  second  approach  is  to  estimate  the  frequency  with  which  each  scenario  is  expected  to 
occur,  and  then  to  create  a  single  composite  threat  tree.  For  example,  suppose  that  the 
first  scenario,  the  major  combat  operation,  is  expected  to  occur  only  20%  of  the  time, 
while  insurgencies  are  expected  to  occur  the  remaining  80%  of  the  time.  Then  a 
composite  tree  for  the  platform  and  scenarios  under  study  would  be  that  presented  in 
Figure  6,  which  would  collapse  to  the  threat  tree  given  in  Figure  7. 


Figure  6.  Composite  threat  tree. 


T1 

T2 

T3 

Figure  7.  Composite  threat  tree  collapsed. 
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Using  a  composite  threat  tree  to  design  a  countermeasure  suite  for  a  platform  has  the 
disadvantage  that  the  platform  is  not  optimized  for  either  scenario,  though  with  care  in 
selecting  the  countermeasure  suite  it  will  perform  better  than  the  baseline  in  each  of  the 
scenarios.  This  approach  works  especially  well  if  there  is  considerable  overlap  in  the 
threats  common  to  the  pair  of  scenarios.  The  advantage  of  this  approach  is  that  a  single 
platform  is  created  with  its  attendant  easing  of  training  and  logistical  issues. 

Generally,  in  selecting  a  countermeasure  suite  to  enhance  the  protection  of  a  platform  the 
analyst  considers  only  threat  trees  for  the  platform  under  consideration;  he  justifiably 
ignores  platform  trees.  Nevertheless,  platform  trees  for  different  scenarios  can  be  usefully 
combined  in  a  fashion  analogous  to  that  used  for  combining  threat  trees. 

As  noted  above,  threat  trees  for  the  same  platform  in  different  scenarios  can  be  combined 
in  a  fashion  that  the  analyst  can  use,  and  similarly  with  platform  trees.  However,  in  a 
system-of-systems  environment,  it’s  desired  to  fix  the  scenario  (at  least  initially)  and  to 
combine  threat  trees  for  distinct  platforms  and  platform  trees  for  distinct  threats  into 
something  that  the  analyst  can  use  in  improving  the  survivability  of  the  entire  force. 

The  goal  then  is  to  determine  what  information  is  required  in  order  that  the  given 
scenario  be  determined.  By  this  is  meant  enough  information  that  all  the  threat  trees  and 
platform  trees  are  determined. 

For  ease  of  illustration,  the  simplest  scenario  with  multiple  threats  and  multiple  platforms 
will  be  assumed,  that  is,  it  will  be  assumed  that  there  are  just  two  threats,  77  and  T2,  and 
two  platforms,  PI  and  P2. 

PLATFORM  TREES  ARE  NOT  DETERMINED  BY  THREAT  TREES 

To  demonstrate  that  platform  trees  are  not  determined  by  threat  trees  it  is  sufficient  to 
construct  a  pair  of  threat  trees  that  are  consistent  with  two  distinct  pairs  of  platform  trees. 
To  this  end  consider  the  threat  trees  given  in  Figure  8. 


Figure  8.  Threat  trees  for  PI  and  P2. 

The  simplest  approach  to  construct  a  pair  of  platform  trees  consistent  with  the  threats 
trees  in  Figure  8  is  to  assume  two  bits  of  information.  First,  assume  the  quantity  of  77- 
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type  threats  is  known,  say  100,  and  secondly,  assume  that  the  quantity  of  77-type  threats 
which  engage  PI -type  platforms  is  also  known,  say  90. 

Let  .Vy  denote  the  quantity  of  Ti  threats  that  engage  a  Pj  platform.  In  this  instance,  both  i 
and  j  take  values  1  or  2. 

From  the  paragraph  just  after  Figure  8,  xn+xn  =  100,  that  is,  the  total  number  of  77-type 
threats  is  100,  and  xn  =  90,  that  is,  the  number  of  77 -type  threats  that  engage  PI  -type 
platforms  is  90.  It  follows  that  jc12  =  10.  In  order  to  be  consistent  with  the  threats  in  Figure 
8,  it  must  be  the  case  that  x21  =  90  (equal  numbers  of  each  threat  engage  PI),  and  that  x22 
=  40  (the  number  of  72s  that  engage  a  P2  is  four  times  the  number  of  77  s  that  engage  a 
P2).  This  implies  that  the  platform  trees  for  this  scenario  are  those  given  in  Figure  9. 


Figure  9.  Platform  trees  for  77  and  72,  consistent  with  Figure  8. 

In  pursuit  of  a  pair  of  platform  trees  distinct  from  those  in  Figure  9,  but  still  consistent 
with  the  threat  trees  of  Figure  8,  it’s  only  required  that  a  different  assumption  regarding 
xn  be  made.  Thus,  leave  xu+x12  =  100,  but  take  xn  =  50,  rather  than  90  as  above.  Then  xl2 
=  50.  And  to  preserve  consistency  with  the  threat  trees  in  Figure  8,  x21  =  50,  and  x22  = 

200.  Thus,  the  platform  trees  for  this  scenario  are  those  given  in  Figure  10. 


Figure  10.  Platform  trees  for  77  and  72,  consistent  with  Figure  8. 

Since  the  platform  trees  in  Figures  9  and  10  are  clearly  distinct,  and  since  both  are 
consistent  with  the  threat  trees  given  in  Figure  8,  the  title  of  this  section  has  been 
established,  that  is,  threat  trees  do  not  determine  platform  trees. 

THREAT  TREES  ARE  NOT  DETERMINED  BY  PLATFORM  TREES 
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To  demonstrate  that  threat  trees  are  not  determined  by  platform  trees  it  is  sufficient  to 
construct  a  pair  of  platform  trees  that  are  consistent  with  two  distinct  pairs  of  threat  trees. 
To  this  end  consider  the  platform  trees  given  in  Figure  1 1 . 


Figure  11.  Platform  trees  for  77  and  72. 

The  simplest  approach  to  construct  a  pair  of  threat  trees  consistent  with  the  platform  trees 
in  Figure  11  is  to  assume  two  bits  of  information.  First,  assume  the  quantity  of  77 -type 
threats  is  known,  say  100,  and  secondly,  assume  that  the  quantity  of  72-type  threats  is 
also  known,  also  say  100. 

As  in  the  preceding  section,  let  x{j  denote  the  quantity  of  Ti  threats  that  engage  a  Pj 
platform.  In  this  instance,  both  i  and  j  take  values  1  or  2. 

From  the  paragraph  just  after  Figure  11,  xn+x12  =  100,  that  is,  the  total  number  of  77 -type 
threats  is  100,  and  x2[+x22  =  100,  that  is,  the  number  of  12-type  threats  is  1 00.  In  order  to 
be  consistent  with  the  first  of  the  platform  trees  in  Figure  1 1 ,  it  must  be  the  case  that  xu  = 
x12  =  50  (77  engages  equal  numbers  of  each  platform  type).  In  order  to  be  consistent  with 
the  second  platform  tree  in  Figure  1 1,  x21  =  10  (the  number  of  72s  that  engage  a  PI  is 
one-tenth  of  the  total  quantity  of  72s),  and  x22  =  90  (the  number  of  72s  that  engage  a  P2  is 
nine-tenths  of  the  total  quantity  of  72s).  These  values  imply  that  the  threat  trees  for  this 
scenario  are  those  given  in  Figure  12. 


Figure  12.  Threat  trees  for  PI  and  P2,  consistent  with  Figure  1 1 . 

In  pursuit  of  a  pair  of  threat  trees  distinct  from  those  in  Figure  12,  but  still  consistent  with 
the  platform  trees  of  Figure  1 1,  it’s  only  required  that  a  different  assumption  regarding 
the  quantity  of  72-type  threats  be  made.  Thus,  leave  xn+x12  =  100,  but  take  x21+x22  =  300, 
rather  than  100  as  above.  Then  to  preserve  consistency  with  the  platform  trees  of  Figure 
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1 1,  x„  =  x12  =  50,  and  jc2,  =  30,  x22  =  270.  Thus,  the  threat  trees  for  this  scenario  are  those 
given  in  Figure  13. 


Figure  13.  Threat  trees  for  PI  and  P2,  consistent  with  Figure  1 1 . 

Since  the  threat  trees  in  Figures  12  and  13  are  clearly  distinct,  and  since  both  are 
consistent  with  the  platform  trees  given  in  Figure  1 1,  the  title  of  this  section  has  been 
established,  that  is,  platform  trees  do  not  determine  threat  trees. 

REQUIRED:  A  QUANTITY  MATRIX 

Careful  attention  is  to  the  above  examples  are  sufficient  to  determine  what  is  in  fact 
required  in  order  to  specify  a  particular  battlefield  scenario,  and  that  is  a  quantity  matrix , 
where  the  number  of  rows  in  the  matrix  equals  the  number  of  threat-types  in  the  scenario, 
and  the  number  of  columns  in  the  matrix  equals  the  number  of  platform-types  in  the 
scenario,  with  the  requirement  that  entry  in  the  ith-row  and  jth-column  of  the  matrix 
provides  the  quantity  of  77-type  threats  allocated  to  attach  Pj -type  platforms. 

Furthermore,  a  quantity  matrix  for  a  given  scenario  uniquely  determines  the  threat  tree 
for  each  platform  in  the  scenario,  and  also  uniquely  determines  the  platform  tree  for  each 
threat  in  the  scenario.  The  converse  is  not,  however,  true.  In  fact,  a  collection  of  threat 
trees  and  platform  trees  for  each  platform  and  threat,  respectively,  in  a  given  scenario 
may  not  even  be  consistent.  That  is,  there  may  be  no  quantity  matrix  they  are  all  in 
agreement  with.  Thus,  the  quantity  matrix  itself  is  the  fundamental  data  item  that  is 
required  for  the  analyst  to  study  a  system-of-systems  scenario. 

CONCLUSIONS 

It  has  been  shown  that  neither  threat  trees,  platform  trees,  or  both  provide  the  analyst  with 
sufficient  information  to  adequately  represent  a  force-on-force  scenario  for  the  purpose  of 
survivability  tradeoff  analysis  in  a  system-of-systems  environment,  but  that  a  quantity 
matrix  as  defined  above  is  adequate. 

It’s  interesting  to  note  that  both  Schwarz,  [2],  and  Hicks  generally  created  the  threat  trees 
required  of  them  in  survivability  studies  by  creating  a  quantity  matrix  for  a  single 
platform,  and  then  suppressing  the  quantity  data,  leaving  only  the  probabilities  of 
encounter. 
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Thus,  perhaps  not  surprisingly,  what  the  analyst  requires  for  a  tradeoff  analysis  of  a 
future  force  is  an  inventory  of  the  battlefield. 
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